Cloudanix VulnDB

CVE-2026-109869

High · 7.5

CVSS

7.5

EPSS

0.3%

Published

Oct 15, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A malicious web server can crash certain Node.js programs that fetch web content, causing those programs to stop working until restarted.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Trivial
Impact
Denial Of Service
Component
Library
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The fetch() implementation creates an internal response stream before validating the content-encoding limit; when a response exceeds five codings and the connection closes early, an unhandled content-length mismatch error on the orphaned stream terminates the Node.js process.

Why it matters to the business

A single malicious HTTP response can crash Node.js applications using affected undici versions, causing service outages and requiring restarts; Red Hat nodejs24-main and nodejs26-main packages are impacted with fixes available in 24.21.0-1.5.hum1 and 26.12.1-0.1.hum1.

How an attack unfolds

An attacker hosts a server that replies to a fetch request with more than five Content-Encoding values and immediately closes the connection without a body; undici rejects the response after stream creation but leaves the stream without an error handler, surfacing a fatal mismatch that Node.js treats as uncaught and terminates the process.

How to fix it

Upgrade undici to 6.29.1, 7.30.1, or 8.12.2 or later; for Red Hat systems apply nodejs24-main 24.21.0-1.5.hum1 or nodejs26-main 26.12.1-0.1.hum1 via RHSA-2026:84706. No workaround exists.

How to confirm the fix worked

Confirm undici version is at or above the fixed releases, then replay a test response with six content codings and early close to verify the process no longer crashes.

Typical attack path

  1. Identify a target application that performs outbound fetch calls via vulnerable undici
  2. Serve a crafted HTTP response containing six or more content codings followed by an immediate connection close
  3. Trigger the fetch from the target; the unhandled stream error crashes the Node.js process
  4. Repeat the request to sustain denial of service

How to detect it

Monitor Node.js process logs and systemd/journald for abrupt terminations immediately following outbound HTTP responses; correlate with fetch calls that receive multi-encoding responses.

What your security team should do

  • Apply the Red Hat security updates for nodejs24-main and nodejs26-main immediately given the 11-day publication window
  • Inventory all Node.js services that depend on undici and schedule upgrades
  • Add process crash monitoring and automatic restarts for fetch-dependent workloads until patches are deployed

The record

undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses because of a content-encoding limit, but it created the internal response stream before that check and returned without attaching an error listener or aborting the request, so the early close surfaces a content-length mismatch on the orphaned stream, which Node.js treats as an unhandled error and terminates the process. A remote, unauthenticated server can trigger this with a single response, even when the application correctly catches the fetch() rejection, resulting in a denial of service. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. There is no workaround.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities